move to archive, cleaning up for golive
This commit is contained in:
53
archive/mtpconfigs/ovh/shared-router/shorewall/conntrack
Executable file
53
archive/mtpconfigs/ovh/shared-router/shorewall/conntrack
Executable file
@@ -0,0 +1,53 @@
|
||||
#
|
||||
# Shorewall version 4 - conntrack File
|
||||
#
|
||||
# For information about entries in this file, type "man shorewall-conntrack"
|
||||
#
|
||||
##############################################################################################################
|
||||
?FORMAT 3
|
||||
#ACTION SOURCE DESTINATION PROTO DEST SOURCE USER/ SWITCH
|
||||
# PORT(S) PORT(S) GROUP
|
||||
?if $AUTOHELPERS && __CT_TARGET
|
||||
|
||||
?if __AMANDA_HELPER
|
||||
CT:helper:amanda:PO - - udp 10080
|
||||
?endif
|
||||
|
||||
?if __FTP_HELPER
|
||||
CT:helper:ftp:PO - - tcp 21
|
||||
?endif
|
||||
|
||||
?if __H323_HELPER
|
||||
CT:helper:RAS:PO - - udp 1719
|
||||
CT:helper:Q.931:PO - - tcp 1720
|
||||
?endif
|
||||
|
||||
?if __IRC_HELPER
|
||||
CT:helper:irc:PO - - tcp 6667
|
||||
?endif
|
||||
|
||||
?if __NETBIOS_NS_HELPER
|
||||
CT:helper:netbios-ns:PO - - udp 137
|
||||
?endif
|
||||
|
||||
?if __PPTP_HELPER
|
||||
CT:helper:pptp:PO - - tcp 1723
|
||||
?endif
|
||||
|
||||
?if __SANE_HELPER
|
||||
CT:helper:sane:PO - - tcp 6566
|
||||
?endif
|
||||
|
||||
?if __SIP_HELPER
|
||||
CT:helper:sip:PO - - udp 5060
|
||||
?endif
|
||||
|
||||
?if __SNMP_HELPER
|
||||
CT:helper:snmp:PO - - udp 161
|
||||
?endif
|
||||
|
||||
?if __TFTP_HELPER
|
||||
CT:helper:tftp:PO - - udp 69
|
||||
?endif
|
||||
|
||||
?endif
|
||||
13
archive/mtpconfigs/ovh/shared-router/shorewall/interfaces
Executable file
13
archive/mtpconfigs/ovh/shared-router/shorewall/interfaces
Executable file
@@ -0,0 +1,13 @@
|
||||
#ZONE INTERFACE OPTIONS
|
||||
rr eth0 detect tcpflags,nosmurfs,routefilter,logmartians
|
||||
wan eth1 detect tcpflags,nosmurfs,routefilter,logmartians,sourceroute=0
|
||||
barm eth2 detect tcpflags,nosmurfs,routefilter,logmartians
|
||||
mgmt eth3 detect tcpflags,nosmurfs,routefilter,logmartians
|
||||
asn eth4 detect tcpflags,nosmurfs,routefilter,logmartians
|
||||
s2l eth5 detect tcpflags,nosmurfs,routefilter,logmartians
|
||||
fnf eth6 detect tcpflags,nosmurfs,routefilter,logmartians
|
||||
knel eth7 detect tcpflags,nosmurfs,routefilter,logmartians
|
||||
tsys eth8 detect tcpflags,nosmurfs,routefilter,logmartians
|
||||
vpnrwr tun0 detect dhcp
|
||||
vpnauslab tun1 detect dhcp
|
||||
vpnasn2net tun2 detect dhcp
|
||||
19
archive/mtpconfigs/ovh/shared-router/shorewall/masq
Executable file
19
archive/mtpconfigs/ovh/shared-router/shorewall/masq
Executable file
@@ -0,0 +1,19 @@
|
||||
#
|
||||
# Shorewall version 4.0 - Sample Masq file for two-interface configuration.
|
||||
# Copyright (C) 2006 by the Shorewall Team
|
||||
#
|
||||
# This library is free software; you can redistribute it and/or
|
||||
# modify it under the terms of the GNU Lesser General Public
|
||||
# License as published by the Free Software Foundation; either
|
||||
# version 2.1 of the License, or (at your option) any later version.
|
||||
#
|
||||
# See the file README.txt for further details.
|
||||
#------------------------------------------------------------------------------
|
||||
# For information about entries in this file, type "man shorewall-masq"
|
||||
################################################################################################################
|
||||
#INTERFACE:DEST SOURCE ADDRESS PROTO PORT(S) IPSEC MARK USER/ SWITCH ORIGINAL
|
||||
# GROUP DEST
|
||||
eth1 10.0.0.0/8,\
|
||||
169.254.0.0/16,\
|
||||
172.16.0.0/12,\
|
||||
192.168.0.0/16
|
||||
28
archive/mtpconfigs/ovh/shared-router/shorewall/params
Executable file
28
archive/mtpconfigs/ovh/shared-router/shorewall/params
Executable file
@@ -0,0 +1,28 @@
|
||||
#
|
||||
# Shorewall version 4 - Params File
|
||||
#
|
||||
# /etc/shorewall/params
|
||||
#
|
||||
# Assign any variables that you need here.
|
||||
#
|
||||
# It is suggested that variable names begin with an upper case letter
|
||||
# to distinguish them from variables used internally within the
|
||||
# Shorewall programs
|
||||
#
|
||||
# Example:
|
||||
#
|
||||
# NET_IF=eth0
|
||||
# NET_BCAST=130.252.100.255
|
||||
# NET_OPTIONS=routefilter,norfc1918
|
||||
#
|
||||
# Example (/etc/shorewall/interfaces record):
|
||||
#
|
||||
# net $NET_IF $NET_BCAST $NET_OPTIONS
|
||||
#
|
||||
# The result will be the same as if the record had been written
|
||||
#
|
||||
# net eth0 130.252.100.255 routefilter,norfc1918
|
||||
#
|
||||
###############################################################################
|
||||
|
||||
#LAST LINE -- DO NOT REMOVE
|
||||
20
archive/mtpconfigs/ovh/shared-router/shorewall/policy
Executable file
20
archive/mtpconfigs/ovh/shared-router/shorewall/policy
Executable file
@@ -0,0 +1,20 @@
|
||||
#SOURCE ZONE DESTINATION ZONE POLICY LOG LIMIT:BURST
|
||||
# LEVEL
|
||||
#Allow the firewall to get out to the net. Updates/e-mail alerts etc. I could pinhole this, but meh COME AT ME NSA
|
||||
$FW wan ACCEPT
|
||||
|
||||
#Road warrior is trusted. It serves as an extension of the mgmt net.
|
||||
vpnrwr all ACCEPT
|
||||
|
||||
#Anything transisting the vpn link between ausprod-core-rtr01 and tsys-rtr has already been passed firewall rules and IPS inspection.
|
||||
#Otherwise I wouldn't allow this
|
||||
vpnauslab all ACCEPT
|
||||
|
||||
#Drop everything inbound from the big bad world that isn't explicitly allowed.
|
||||
#Cause the net is where the NSA lives
|
||||
wan all DROP
|
||||
|
||||
#Drop everything that isn't explicitly allowed.
|
||||
#Make explicit rules for everything yo. The NSA says you should. Duh.
|
||||
# #state-sponsored-malware #stuxnet-was-an-inside-job
|
||||
all all REJECT info
|
||||
113
archive/mtpconfigs/ovh/shared-router/shorewall/rules
Executable file
113
archive/mtpconfigs/ovh/shared-router/shorewall/rules
Executable file
@@ -0,0 +1,113 @@
|
||||
#ACTION SOURCE DEST PROTO DEST PORT(S) SOURCE ORIGINAL
|
||||
###########################################################################################################################################################################################################
|
||||
#Inbound DNAT forwarding from WAN to various zone/ip pinholes
|
||||
###########################################################################################################################################################################################################
|
||||
#########################################################
|
||||
#KNEL rules
|
||||
#158.69.183.165/29 eth1:2
|
||||
#########################################################
|
||||
DNAT wan knel:10.253.8.72 tcp 443 - 158.69.183.165
|
||||
DNAT wan knel:10.253.8.72 tcp 80 - 158.69.183.165
|
||||
DNAT wan knel:10.253.8.72 tcp 993 - 158.69.183.165
|
||||
DNAT wan knel:10.253.8.72 tcp 25 - 158.69.183.165
|
||||
DNAT wan knel:10.253.8.72 tcp 465 - 158.69.183.165
|
||||
DNAT wan knel:10.253.8.72 tcp 5222 - 158.69.183.165
|
||||
|
||||
#########################################################
|
||||
#TSYS rules
|
||||
#158.69.183.161/29 eth1
|
||||
#########################################################
|
||||
DNAT wan tsys:10.253.9.78 tcp 443 - 158.69.183.161
|
||||
DNAT wan tsys:10.253.9.78 tcp 80 - 158.69.183.161
|
||||
DNAT wan tsys:10.253.9.78 tcp 25 - 158.69.183.161
|
||||
DNAT wan tsys:10.253.9.78 tcp 465 - 158.69.183.161
|
||||
DNAT wan tsys:10.253.9.78 tcp 5222 - 158.69.183.161
|
||||
|
||||
#########################################################
|
||||
#RackRental WAN rules
|
||||
#158.69.183.164/29 eth1:1
|
||||
#########################################################
|
||||
#158.69.183.164/29
|
||||
DNAT wan rr:10.253.6.81 tcp 443 - 158.69.183.164
|
||||
DNAT wan rr:10.253.6.81 tcp 80 - 158.69.183.164
|
||||
|
||||
############################################################
|
||||
#S2l/asn WAN rules handled by their upstream routers/admins
|
||||
############################################################
|
||||
|
||||
###########################################################################################################################################################################################################
|
||||
#site to site and road warrior VPN rules
|
||||
###########################################################################################################################################################################################################
|
||||
|
||||
#Allow road warrior connectivity from anywhere
|
||||
ACCEPT wan fw udp 443
|
||||
|
||||
#Allow auslab site to site vpn
|
||||
ACCEPT wan fw tcp 1195
|
||||
ACCEPT wan fw udp 1195
|
||||
|
||||
|
||||
############################################################
|
||||
#FW rules for RoadWarrior VPN
|
||||
############################################################
|
||||
ACCEPT all vpnrwr all
|
||||
|
||||
############################################################
|
||||
#FW rules for STS VPN - AUSLAB
|
||||
#ACCEPT loc vpnauslab all
|
||||
############################################################
|
||||
ACCEPT vpnauslab all all
|
||||
ACCEPT $FW vpnauslab all
|
||||
|
||||
############################################################
|
||||
#FW rules for STS VPN - client - asn2net
|
||||
#Lock this down soon
|
||||
############################################################
|
||||
ACCEPT $FW vpnasn2net all
|
||||
ACCEPT vpnasn2net $FW all
|
||||
|
||||
|
||||
###########################################################################################################################################################################################################
|
||||
#outbound from various local nets and the firewall to WAN
|
||||
###########################################################################################################################################################################################################
|
||||
ACCEPT rr wan all #Lock this down soon
|
||||
ACCEPT rr tsys all #Lock this down soon
|
||||
ACCEPT knel,tsys,mgmt wan all
|
||||
|
||||
|
||||
#Temp rules to get stuff working..
|
||||
ACCEPT $FW all all #Fw can access everything for now, Lock this down later
|
||||
ACCEPT mgmt $FW
|
||||
|
||||
ACCEPT vpnauslab mgmt all
|
||||
ACCEPT vpnauslab all all
|
||||
|
||||
###########################################################################################################################################################################################################
|
||||
#intra zone pinhole rules
|
||||
###########################################################################################################################################################################################################
|
||||
ACCEPT vpnrwr,rr,barm,tsys,knel,fnf mgmt:10.253.3.86 udp 53
|
||||
ACCEPT vpnrwr,rr,barm,tsys,knel,fnf mgmt:10.253.3.86 tcp 53
|
||||
|
||||
###########################################################################################################################################################################################################
|
||||
#intra zone wide rules
|
||||
###########################################################################################################################################################################################################
|
||||
#Mgmt can hit everything yo, cause it's fucking management with a capital M
|
||||
ACCEPT mgmt barm,tsys,knel,fnf,vpnrwr,asn,s2l,vpnauslab all
|
||||
|
||||
#Ad replication rule
|
||||
ACCEPT mgmt:10.253.3.86 vpnauslab:10.251.2.98 all
|
||||
ACCEPT vpnauslab:10.251.2.98 mgmt:10.253.3.86 all
|
||||
|
||||
#Zenoss rule
|
||||
ACCEPT mgmt:10.253.3.77 all all
|
||||
|
||||
|
||||
|
||||
|
||||
#Brendan mgmt access
|
||||
ACCEPT vpnasn2net:10.30.1.2 mgmt:10.253.3.86 udp 53
|
||||
ACCEPT vpnasn2net:10.30.1.2 mgmt:10.253.3.86 tcp 53
|
||||
ACCEPT vpnasn2net:10.30.3.0/24 $FW
|
||||
ACCEPT vpnasn2net:10.30.2.0/24 $FW
|
||||
ACCEPT vpnasn2net:10.30.2.0/24 mgmt
|
||||
ACCEPT vpnasn2net:10.30.3.0/24 mgmt
|
||||
274
archive/mtpconfigs/ovh/shared-router/shorewall/shorewall.conf
Executable file
274
archive/mtpconfigs/ovh/shared-router/shorewall/shorewall.conf
Executable file
@@ -0,0 +1,274 @@
|
||||
###############################################################################
|
||||
#
|
||||
# Shorewall Version 4 -- /etc/shorewall/shorewall.conf
|
||||
#
|
||||
# For information about the settings in this file, type "man shorewall.conf"
|
||||
#
|
||||
# Manpage also online at http://www.shorewall.net/manpages/shorewall.conf.html
|
||||
###############################################################################
|
||||
# S T A R T U P E N A B L E D
|
||||
###############################################################################
|
||||
|
||||
STARTUP_ENABLED=Yes
|
||||
|
||||
###############################################################################
|
||||
# V E R B O S I T Y
|
||||
###############################################################################
|
||||
|
||||
VERBOSITY=1
|
||||
|
||||
###############################################################################
|
||||
# L O G G I N G
|
||||
###############################################################################
|
||||
|
||||
BLACKLIST_LOG_LEVEL=
|
||||
|
||||
INVALID_LOG_LEVEL=
|
||||
|
||||
LOG_MARTIANS=Yes
|
||||
|
||||
LOG_VERBOSITY=2
|
||||
|
||||
LOGALLNEW=
|
||||
|
||||
LOGFILE="/var/log/firewall.log"
|
||||
|
||||
LOGFORMAT="%s:%s:"
|
||||
|
||||
LOGTAGONLY=No
|
||||
|
||||
LOGLIMIT=
|
||||
|
||||
MACLIST_LOG_LEVEL=info
|
||||
|
||||
RELATED_LOG_LEVEL=
|
||||
|
||||
RPFILTER_LOG_LEVEL=info
|
||||
|
||||
SFILTER_LOG_LEVEL=info
|
||||
|
||||
SMURF_LOG_LEVEL=info
|
||||
|
||||
STARTUP_LOG=/var/log/shorewall-init.log
|
||||
|
||||
TCP_FLAGS_LOG_LEVEL=info
|
||||
|
||||
UNTRACKED_LOG_LEVEL=
|
||||
|
||||
###############################################################################
|
||||
# L O C A T I O N O F F I L E S A N D D I R E C T O R I E S
|
||||
###############################################################################
|
||||
|
||||
ARPTABLES=
|
||||
|
||||
CONFIG_PATH="${CONFDIR}/shorewall:${SHAREDIR}/shorewall"
|
||||
|
||||
GEOIPDIR=/usr/share/xt_geoip/LE
|
||||
|
||||
IPTABLES=
|
||||
|
||||
IP=
|
||||
|
||||
IPSET=
|
||||
|
||||
LOCKFILE=
|
||||
|
||||
MODULESDIR=
|
||||
|
||||
NFACCT=
|
||||
|
||||
PATH="/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin:/usr/local/sbin"
|
||||
|
||||
PERL=/usr/bin/perl
|
||||
|
||||
RESTOREFILE=restore
|
||||
|
||||
SHOREWALL_SHELL=/bin/sh
|
||||
|
||||
SUBSYSLOCK=""
|
||||
|
||||
TC=
|
||||
|
||||
###############################################################################
|
||||
# D E F A U L T A C T I O N S / M A C R O S
|
||||
###############################################################################
|
||||
|
||||
ACCEPT_DEFAULT=none
|
||||
DROP_DEFAULT=Drop
|
||||
NFQUEUE_DEFAULT=none
|
||||
QUEUE_DEFAULT=none
|
||||
REJECT_DEFAULT=Reject
|
||||
|
||||
###############################################################################
|
||||
# R S H / R C P C O M M A N D S
|
||||
###############################################################################
|
||||
|
||||
RCP_COMMAND='scp ${files} ${root}@${system}:${destination}'
|
||||
RSH_COMMAND='ssh ${root}@${system} ${command}'
|
||||
|
||||
###############################################################################
|
||||
# F I R E W A L L O P T I O N S
|
||||
###############################################################################
|
||||
|
||||
ACCOUNTING=Yes
|
||||
|
||||
ACCOUNTING_TABLE=filter
|
||||
|
||||
ADD_IP_ALIASES=No
|
||||
|
||||
ADD_SNAT_ALIASES=No
|
||||
|
||||
ADMINISABSENTMINDED=Yes
|
||||
|
||||
IGNOREUNKNOWNVARIABLES=No
|
||||
|
||||
AUTOCOMMENT=Yes
|
||||
|
||||
AUTOHELPERS=Yes
|
||||
|
||||
AUTOMAKE=No
|
||||
|
||||
BLACKLIST="NEW,INVALID,UNTRACKED"
|
||||
|
||||
CHAIN_SCRIPTS=Yes
|
||||
|
||||
CLAMPMSS=No
|
||||
|
||||
CLEAR_TC=Yes
|
||||
|
||||
COMPLETE=No
|
||||
|
||||
DEFER_DNS_RESOLUTION=Yes
|
||||
|
||||
DELETE_THEN_ADD=Yes
|
||||
|
||||
DETECT_DNAT_IPADDRS=No
|
||||
|
||||
DISABLE_IPV6=No
|
||||
|
||||
DONT_LOAD=
|
||||
|
||||
DYNAMIC_BLACKLIST=Yes
|
||||
|
||||
EXPAND_POLICIES=Yes
|
||||
|
||||
EXPORTMODULES=Yes
|
||||
|
||||
FASTACCEPT=No
|
||||
|
||||
FORWARD_CLEAR_MARK=
|
||||
|
||||
HELPERS=
|
||||
|
||||
IMPLICIT_CONTINUE=No
|
||||
|
||||
IPSET_WARNINGS=Yes
|
||||
|
||||
IP_FORWARDING=On
|
||||
|
||||
KEEP_RT_TABLES=No
|
||||
|
||||
LEGACY_FASTSTART=Yes
|
||||
|
||||
LOAD_HELPERS_ONLY=No
|
||||
|
||||
MACLIST_TABLE=filter
|
||||
|
||||
MACLIST_TTL=
|
||||
|
||||
MANGLE_ENABLED=Yes
|
||||
|
||||
MAPOLDACTIONS=No
|
||||
|
||||
MARK_IN_FORWARD_CHAIN=No
|
||||
|
||||
MODULE_SUFFIX=ko
|
||||
|
||||
MULTICAST=Yes
|
||||
|
||||
MUTEX_TIMEOUT=60
|
||||
|
||||
NULL_ROUTE_RFC1918=No
|
||||
|
||||
OPTIMIZE=0
|
||||
|
||||
OPTIMIZE_ACCOUNTING=No
|
||||
|
||||
REJECT_ACTION=
|
||||
|
||||
REQUIRE_INTERFACE=No
|
||||
|
||||
RESTORE_DEFAULT_ROUTE=Yes
|
||||
|
||||
RESTORE_ROUTEMARKS=Yes
|
||||
|
||||
RETAIN_ALIASES=No
|
||||
|
||||
ROUTE_FILTER=Yes
|
||||
|
||||
SAVE_ARPTABLES=No
|
||||
|
||||
SAVE_IPSETS=No
|
||||
|
||||
TC_ENABLED=Internal
|
||||
|
||||
TC_EXPERT=No
|
||||
|
||||
TC_PRIOMAP="2 3 3 3 2 3 1 1 2 2 2 2 2 2 2 2"
|
||||
|
||||
TRACK_PROVIDERS=No
|
||||
|
||||
TRACK_RULES=No
|
||||
|
||||
USE_DEFAULT_RT=No
|
||||
|
||||
USE_PHYSICAL_NAMES=No
|
||||
|
||||
USE_RT_NAMES=No
|
||||
|
||||
WARNOLDCAPVERSION=Yes
|
||||
|
||||
ZONE2ZONE=2
|
||||
|
||||
###############################################################################
|
||||
# P A C K E T D I S P O S I T I O N
|
||||
###############################################################################
|
||||
|
||||
BLACKLIST_DISPOSITION=DROP
|
||||
|
||||
INVALID_DISPOSITION=CONTINUE
|
||||
|
||||
MACLIST_DISPOSITION=REJECT
|
||||
|
||||
RELATED_DISPOSITION=ACCEPT
|
||||
|
||||
RPFILTER_DISPOSITION=DROP
|
||||
|
||||
SMURF_DISPOSITION=DROP
|
||||
|
||||
SFILTER_DISPOSITION=DROP
|
||||
|
||||
TCP_FLAGS_DISPOSITION=DROP
|
||||
|
||||
UNTRACKED_DISPOSITION=CONTINUE
|
||||
|
||||
################################################################################
|
||||
# P A C K E T M A R K L A Y O U T
|
||||
################################################################################
|
||||
|
||||
TC_BITS=
|
||||
|
||||
PROVIDER_BITS=
|
||||
|
||||
PROVIDER_OFFSET=
|
||||
|
||||
MASK_BITS=
|
||||
|
||||
ZONE_BITS=0
|
||||
|
||||
################################################################################
|
||||
# L E G A C Y O P T I O N
|
||||
# D O N O T D E L E T E O R A L T E R
|
||||
################################################################################
|
||||
|
||||
IPSECFILE=zones
|
||||
14
archive/mtpconfigs/ovh/shared-router/shorewall/zones
Executable file
14
archive/mtpconfigs/ovh/shared-router/shorewall/zones
Executable file
@@ -0,0 +1,14 @@
|
||||
#ZONE TYPE OPTIONS
|
||||
fw firewall
|
||||
rr ipv4
|
||||
wan ipv4
|
||||
barm ipv4
|
||||
mgmt ipv4
|
||||
asn ipv4
|
||||
s2l ipv4
|
||||
fnf ipv4
|
||||
knel ipv4
|
||||
tsys ipv4
|
||||
vpnrwr ipv4
|
||||
vpnauslab ipv4
|
||||
vpnasn2net ipv4
|
||||
Reference in New Issue
Block a user